[问题求助] VBS调用第三方程序实现截屏/屏幕截图

Tianorder

这代码是什么语言？
我已经知道如何截图了，但仍不知道如何区域截图。也不知道如何裁图，明明调整全屏截图的画布大小就可以达到区域截图的目的。
找到了如下代码，甚至不知道原文出自哪里。

data = "4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000C00000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000450E6EDA016F0089016F0089016F0089016F0189006F008963701389026F0089E9700B89006F008952696368016F008900000000000000000000000000000000504500004C01010017E773460000000000000000E0000F010B01060000000000000400000000000080110000001000000010000000004000001000000002000004000000000000000400000000000000002000000002000000000000020000000000100000100000000010000010000000000000100000000000000000000000F012000028000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000080000000000000000000000000000000000000000000000000000002E646174610000003A030000001000000004000000020000000000000000000000000000400000C0000000000000000000000000000000000000000000000000000000000000000020130000000000004D657373616765426F784100476574436F6D6D616E644C696E6541006B657962645F6576656E74004578697450726F6365737300467265654C696272617279004C6F61644C6962726172794100000000757365723332000053637265656E4361746368204279205368696C7978000000B3C9B9A6BDABD7A5CDBCB1A3B4E6B5BDCFB5CDB3BCF4CCF9B0E5000000000000000000000000000083EC0C535556578B7C24208B473C03C78138504500000F858E0000008B48788B44392003CF03C7894C2418C7442420000000008B491885C9894C2414766C8B6C2424894424248A4D008BD181E2FF00000089542410EB048B5424108B008BCD8D343833C08A062BC275248A55002BF584D274178A51014133C08BDA8A040E81E3FF0000002BC374E7EB0485C074268B4C24208B4424248B5424144183C0043BCA894C24208944242472AD5F5E5D33C05B83C40CC38B4424188B5424208B48248B401C8D0C5133D2668B14398D0C908B043903C75F5E5D5B83C40CC39090909090558BEC81EC48010000535657B906000000BE781040008D7DBCF3A566A5A4B905000000BE601040008D7DD8A158104000F3A5668B0D5C1040008A155E10400066A58945F466894DF88855FAC745FC0000000064A1180000008945FC8B45FC68481040008B48308B510C8B420C8B088B118B721856E8A7FEFFFF683C104000568BF8E89AFEFFFF6830104000568945FCE88CFEFFFF83C4188945F08D45F450FFD78BD8682410400053E873FEFFFF8B3D0010400083C4086A006A006A006A2CFFD76A006A026A006A2CFFD7681410400056E84BFEFFFF8BD0B94000000033C08DBDB9FEFFFFC685B8FEFFFF0083C408F3AB66ABAAFFD28BF883C9FF33C08D95B8FEFFFFF2AEF7D12BF98BC18BF78BFAC1E902F3A58BC833C083E103F3A48DBDB8FEFFFF83C9FFF2AEF7D1498A8C0DB7FEFFFF80F973742180F953741C680810400053E8DAFDFFFF83C4088D4DD88D55BC6A4051526A00FFD053FF55FC6A00FF55F05F5E5B8BE55DC39090909090909090901813000000000000000000002E1300000010000000000000000000000000000000000000000000002013000000000000AA026B657962645F6576656E74005553455233322E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
TargetFileName = "C:/mp.exe"
With CreateObject("ADODB.Stream"):.Type = 1:.Open:.Write StrToByte(data):.SaveToFile TargetFileName, 2:.Close:End With
WScript.CreateObject("WScript.Shell").Run TargetFileName & " /s"
MsgBox "当前屏幕图象已经拷贝到系统剪贴板", 64, "信息"
Function StrToByte(str)
        Set xmldoc = CreateObject("Microsoft.XMLDOM")
        xmldoc.loadXML "<?xml version=""1.0""?>"
        Set pic = xmldoc.createElement("pic")
        pic.dataType = "bin.hex"
        pic.nodeTypedValue = str
        StrToByte = pic.nodeTypedValue
End Function
复制代码

这个方法很厉害呀，先用这什么语言写个软件，再把其二进制代码输到VBS，让VBS创建该程序并调用之。
本代码将生成用途为全屏截图的exe文件。想知道这exe是用什么代码写的。

pcl_test

vbs+c#.net

'发送prtsc键+剪贴板获取图片，期间将清除剪贴板内容
Set objShell = CreateObject("Wscript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")
currentpath = fso.GetFolder(".").Path '设置图片保存路径，默认为当前文件夹
Set tmp = fso.GetSpecialFolder(2)
Set systemroot = fso.GetSpecialFolder(0)
net = systemroot&"\Microsoft.NET\Framework"
If not fso.FileExists(tmp&"\$PrtSc.cs") Then
    Call CreateCs
    Set SubFolders = fso.GetFolder(net).SubFolders
    For Each Folder In SubFolders
        If fso.FileExists(Folder&"\csc.exe") Then
            cscpath = Folder&"\csc.exe"
            Exit For
        End If
    Next
    If cscpath = "" Then
        Msgbox "未安装Microsoft .NET Framework 2.0及以上组件或是相关程序缺失！"
        Wscript.Quit
    Else
        '调用csc.exe编译cs文件
        objShell.Run cscpath&" /out:"""&tmp&"\$PrtSc.exe"" """&tmp&"\$PrtSc.cs""", 0, True
    End If
End If
fso.DeleteFile tmp&"\$PrtSc.cs"
DO  '自行修改截屏条件
    i = i + 1
    objShell.Run tmp&"\$PrtSc.exe", 0, True
    Wscript.Sleep 1000    '设置截屏时间间隔（毫秒）
Loop Until i = 5   '设置截屏张数

Function CreateCs
    'C# codes，调用系统API实现截屏
    Set cs = fso.CreateTextFile(tmp&"\$PrtSc.cs", True)
    cs.Write _
    "using System;using System.Drawing;using System.Drawing.Imaging;" & vbCrLf & _
    "using System.Windows.Forms;using System.Runtime.InteropServices;" & vbCrLf & _
    "public class Prtsc{" & vbCrLf & _
    "   [DllImport(""user32.dll"")]" & vbCrLf & _
    "   public static extern void keybd_event(byte bVk,byte bScan,uint dwFlags,IntPtr dwExtraInfo);" & vbCrLf & _
    "   [STAThread]" & vbCrLf & _
    "   public static void Main(){" & vbCrLf & _
    "      keybd_event((byte)0x2c, 0, 0x0, IntPtr.Zero);" & vbCrLf & _
    "      keybd_event((byte)0x2c, 0, 0x2, IntPtr.Zero);" & vbCrLf & _
    "      string dt = System.DateTime.Now.ToString(""yyyyMMddHHmmssfff"");" & vbCrLf & _
    "      IDataObject data = Clipboard.GetDataObject();" & vbCrLf & _
    "      if (data.GetDataPresent(DataFormats.Bitmap)){" & vbCrLf & _
    "         Image img = (Image)data.GetData(DataFormats.Bitmap,true);" & vbCrLf & _
    "         img.Save("""&replace(currentpath,"\","\\")&"\\""+dt+"".bmp"", ImageFormat.Bmp);" & vbCrLf & _
    "}}}"
End Function
复制代码

'参考http://www.bathome.net/redirect.php?goto=findpost&pid=78571&ptid=11646
'期间不影响剪贴板内容
Set objShell = CreateObject("Wscript.Shell")
Set fso = CreateObject("Scripting.FileSystemObject")
currentpath = fso.GetFolder(".").Path '设置图片保存路径，默认为当前文件夹
Set tmp = fso.GetSpecialFolder(2)
Set systemroot = fso.GetSpecialFolder(0)
net = systemroot&"\Microsoft.NET\Framework"
If not fso.FileExists(tmp&"\$PrtSc.cs") Then
    Call CreateCs
    Set SubFolders = fso.GetFolder(net).SubFolders
    For Each Folder In SubFolders
        If fso.FileExists(Folder&"\csc.exe") Then
            cscpath = Folder&"\csc.exe"
            Exit For
        End If
    Next
    If cscpath = "" Then
        Msgbox "未安装Microsoft .NET Framework 2.0及以上组件或是相关程序缺失！"
        Wscript.Quit
    Else
        '调用csc.exe编译cs文件
        objShell.Run cscpath&" /out:"""&tmp&"\$PrtSc.exe"" """&tmp&"\$PrtSc.cs""", 0, True
    End If
End If
fso.DeleteFile tmp&"\$PrtSc.cs"
DO  '自行修改截屏条件
    i = i + 1
    objShell.Run tmp&"\$PrtSc.exe", 0, True
    Wscript.Sleep 1000    '设置截屏时间间隔（毫秒）
Loop Until i = 5   '设置截屏张数

Function CreateCs
    Set cs = fso.CreateTextFile(tmp&"\$PrtSc.cs", True)
    cs.Write _
    "using System;using System.Drawing;using System.Drawing.Imaging;using System.Windows.Forms;" & vbCrLf & _
    "public class Prtsc{" & vbCrLf & _
    "   public static void Main(){" & vbCrLf & _
    "       Image img = new Bitmap(Screen.AllScreens[0].Bounds.Width, Screen.AllScreens[0].Bounds.Height);" & vbCrLf & _
    "       Graphics g = Graphics.FromImage(img);" & vbCrLf & _
    "       g.CopyFromScreen(new Point(0, 0), new Point(0, 0), Screen.AllScreens[0].Bounds.Size);" & vbCrLf & _
    "       string dt = System.DateTime.Now.ToString(""yyyyMMddHHmmssfff"");" & vbCrLf & _
    "       img.Save("""&replace(currentpath,"\","\\")&"\\""+dt+"".bmp"", ImageFormat.Bmp);" & vbCrLf & _
    "}}"
End Function
复制代码

CrLf

回复 13# yu2n


    是啊，js 真是越用越爱用，除了老版本 EMACScript 有些功能上的欠缺，其他方面还是非常有意思的

yu2n

回复 11# CrLf

用 VBS 写了个跟你类似的编码程序，体积较大。
解码程序还在琢磨，话说用 JS 也太简洁了吧。

Function CompressionText(ByVal Text)
  Const MinLen = 4
  If Len(Text) <= MinLen Then
    CompressionText = Text
    Exit Function
  End If
  Dim arr(), i, str
  ReDim Preserve arr(1, 0)
  arr(0, 0) = Mid(Text, 1, 1)
  arr(1, 0) = 1
  For i = 2 To Len(Text)
    If Mid(Text, i - 1, 1) = Mid(Text, i, 1) Then
      arr(1, UBound(arr, 2)) = arr(1, UBound(arr, 2)) + 1
    Else
      ReDim Preserve arr(1, UBound(arr, 2) + 1)
      arr(0, UBound(arr, 2)) = Mid(Text, i, 1)
      arr(1, UBound(arr, 2)) = 1
    End If
  Next
  For i = 0 To UBound(arr, 2)
    If arr(1, i) >= MinLen Then
      str = str & arr(0, i) & "[" & arr(1, i) & "]"
    Else
      str = str & String(arr(1, i), arr(0, i))
    End If
  Next
  CompressionText = str
End Function
复制代码

CrLf

回复 5# Demon


   
回复 7# 523066680


   
回复 8# Spring


   
回复 10# yu2n


   
兄弟们求支援，折腾一天了，搞不定：http://www.bathome.net/viewthread.php?tid=37472

CrLf

简单压缩下：

var TextBase64_encode = "TVqQA{2}MA{4}EA{4}/{2}8A{2}LgA{9}QA{1b}sA{5}4fug4AtAnNIbgBTM"+
		"0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJA"+
		"{9}BdXG3BGT0Dkhk9A5IZPQOSlyIQkh49A5LlHRGSGD0DklJpY2gZPQOSA{a"+
		"}BQRQA{2}TAECACGz/EgA{a}OA{2}DwELAQUMA{2}IA{4}CA{9}BA{5}QA{4"+
		"}IA{5}BA{4}QA{5}gA{2}BA{a}EA{b}wA{5}gA{8}IA{6}BA{3}BA{6}EA{3"+
		"}EA{8}BA{f}BAgA{3}8A{34}IA{3}EA{10}C50ZXh0A{4}IA{6}QA{5}gA{4"+
		"}IA{i}CA{3}GAucmRhdGEA{2}JIA{5}IA{5}IA{4}EA{i}BA{3}BA{b}BqAG"+
		"oAagBqLOgHA{4}agDoBgA{3}P8lC{2}BA{2}P8lACBA{hu}HYgA{8}XCA{8}"+
		"BUIA{d}BqIA{3}C{2}A{3}EwgA{d}IQgA{4}IA{t}B2IA{8}FwgA{8}YAJrZ"+
		"XliZF9ldmVudAB1c2VyMzIuZGxsA{2}CA{2}EV4aXRQcm9jZXNzAGtlcm5lb"+
		"DMyLmRsbA{dn}"

var TextBase64 = decode(TextBase64_encode)
WScript.Echo(TextBase64)
var BinaryFile = "PrtSc.EXE"  
var adSaveCreateOverWrite = 2
var adTypeBinary          = 1

var objStream = WScript.CreateObject("ADODB.Stream")  
var objXML = WScript.CreateObject("MSXml2.DOMDocument")
var objDocElem = objXML.createElement("Base64Data")
objDocElem.dataType = "bin.base64"
objDocElem.text = TextBase64
objStream.Type = adTypeBinary
objStream.Open()
objStream.Write(objDocElem.nodeTypedValue)
objStream.SaveToFile(BinaryFile, adSaveCreateOverWrite)
var objXML = null
var objDocElem = null
var objStream = null

WScript.CreateObject("WScript.Shell").Run(BinaryFile, 0, true)
WScript.Echo("截图已复制到剪贴板。")

function decode(str){
	return str.replace(/(.)\{(\w+)\}/g,function($0,$1,$2){return (new Array(parseInt($2,36)+1)).join($1)})
}

function encode(str){
	return str.replace(/(.)\1+/g,function($0,$1){return $1+'{'+$0.length.toString(36)+'}'})
}
复制代码

yu2n

请问各位有没有好的字符串压缩代码，分享一下。

我准备把上面的代码压缩一下，连续的字符太多了，完全可以压缩很多啊。

yu2n

带证书的命令行截图程序难找。本论坛有个不报毒的，编码之后如下：

Dim TextBase64
TextBase64 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAsAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4g" & _
  "RE9TIG1vZGUuDQ0KJAAAAAAAAABdXG3BGT0Dkhk9A5IZPQOSlyIQkh49A5LlHRGSGD0DklJp" & _
  "Y2gZPQOSAAAAAAAAAABQRQAATAECACGz/EgAAAAAAAAAAOAADwELAQUMAAIAAAACAAAAAAAA" & _
  "ABAAAAAQAAAAIAAAAABAAAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAAAwAAAAAgAAAAAAAAIA" & _
  "AAAAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAABAgAAA8AAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAIAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAA" & _
  "IAAAAAAQAAAAAgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucmRhdGEAAJIAAAAAIAAAAAIAAAAE" & _
  "AAAAAAAAAAAAAAAAAABAAABAAAAAAAAAAABqAGoAagBqLOgHAAAAagDoBgAAAP8lCCBAAP8l" & _
  "ACBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHYg" & _
  "AAAAAAAAXCAAAAAAAABUIAAAAAAAAAAAAABqIAAACCAAAEwgAAAAAAAAAAAAAIQgAAAAIAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAB2IAAAAAAAAFwgAAAAAAAAYAJrZXliZF9ldmVudAB1c2Vy" & _
  "MzIuZGxsAACAAEV4aXRQcm9jZXNzAGtlcm5lbDMyLmRsbAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" & _
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
Const BinaryFile = "PrtSc.EXE"  
Const adSaveCreateOverWrite = 2
Const adTypeBinary          = 1
Dim objXML
Dim objDocElem
Dim objStream
Set objStream = CreateObject("ADODB.Stream")  
Set objXML = CreateObject("MSXml2.DOMDocument")
Set objDocElem = objXML.createElement("Base64Data")
objDocElem.DataType = "bin.base64"
objDocElem.text = TextBase64
objStream.Type = adTypeBinary
objStream.Open()
objStream.Write objDocElem.NodeTypedValue
objStream.SaveToFile BinaryFile, adSaveCreateOverWrite
Set objXML = Nothing
Set objDocElem = Nothing
Set objStream = Nothing

CreateObject("WScript.Shell").Run BinaryFile, 0, True
Msgbox "截图已复制到剪贴板。", vbSystemModal+vbInformation, WScript.ScriptName
复制代码

PrtSc.EXE 来源：

[其他] 发送PrtSc键的工具(1.5KB)——可截屏(弥补vbs之SendKeys缺憾)
http://www.bathome.net/thread-2254-1-1.html

Spring

EXE需要的是代码签名证书，得去有权限的颁发机构（国内的比如天威诚信）申请，基本都是要收钱的（一年期大概几千块），一般会给你一个 pfx 格式的文件并告诉你密码，然后你自己使用签名工具可视化操作就可以完成签名了。

当然，要在自己电脑上随便玩玩，可以自己生成一个证书，导入到受信任的区域，用这个给程序签名就可以了

我把这些操作写到一个批处理里面：
MakeCertAndSign.bat

@echo off
REM 几个时间戳服务器
REM http://timestamp.verisign.com/scripts/timstamp.dll
REM http://timestamp.globalsign.com/scripts/timstamp.dll
REM http://timestamp.wosign.com/timestamp 

:Default
set fn=我叫叶良辰
set CN=Spring
set O=Bathome
set C=CN
set EMAIL=Sprint@bathome.net
set b=10/25/2007
set e=10/24/2048

:Customize
set /p fn=生成的证书文件名(例如 "%fn%")：
set /p CN=签名人(例如 "%CN%")：
set /p O=组织(例如 "%O%")：
set /p C=国家(例如 "%C%")：
set /p EMAIL=电子邮件(例如 "%EMAIL%")：
set /p b=证书生效日(例如 "%b%")：
set /p e=证书失效日(例如 "%e%")：

:MakeCert
makecert -n "CN=%CN%,O=%O%,C=%CN%,EMAIL=%EMAIL%" -r -b %b% -e %e% -sv %fn%.pvk %fn%.cer
cert2spc %fn%.cer %fn%.spc

if %errorlevel% neq 0 goto :Exception

:SignWizard
echo 已经生成名为 %fn% 的证书，按任意键启动签名工具进行签名。
pause>nul
start /w signtool signwizard
echo 完成。
pause>nul

goto :EOF

:Exception
echo 操作失败。
pause>nul
复制代码

下面是一个签好的VBS代码，保存为文件之后，你可以在属性里面看到数字签名标签
SignedScripts.vbs

data = "4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000C00000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000450E6EDA016F0089016F0089016F0089016F0189006F008963701389026F0089E9700B89006F008952696368016F008900000000000000000000000000000000504500004C01010017E773460000000000000000E0000F010B01060000000000000400000000000080110000001000000010000000004000001000000002000004000000000000000400000000000000002000000002000000000000020000000000100000100000000010000010000000000000100000000000000000000000F012000028000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000080000000000000000000000000000000000000000000000000000002E646174610000003A030000001000000004000000020000000000000000000000000000400000C0000000000000000000000000000000000000000000000000000000000000000020130000000000004D657373616765426F784100476574436F6D6D616E644C696E6541006B657962645F6576656E74004578697450726F6365737300467265654C696272617279004C6F61644C6962726172794100000000757365723332000053637265656E4361746368204279205368696C7978000000B3C9B9A6BDABD7A5CDBCB1A3B4E6B5BDCFB5CDB3BCF4CCF9B0E5000000000000000000000000000083EC0C535556578B7C24208B473C03C78138504500000F858E0000008B48788B44392003CF03C7894C2418C7442420000000008B491885C9894C2414766C8B6C2424894424248A4D008BD181E2FF00000089542410EB048B5424108B008BCD8D343833C08A062BC275248A55002BF584D274178A51014133C08BDA8A040E81E3FF0000002BC374E7EB0485C074268B4C24208B4424248B5424144183C0043BCA894C24208944242472AD5F5E5D33C05B83C40CC38B4424188B5424208B48248B401C8D0C5133D2668B14398D0C908B043903C75F5E5D5B83C40CC39090909090558BEC81EC48010000535657B906000000BE781040008D7DBCF3A566A5A4B905000000BE601040008D7DD8A158104000F3A5668B0D5C1040008A155E10400066A58945F466894DF88855FAC745FC0000000064A1180000008945FC8B45FC68481040008B48308B510C8B420C8B088B118B721856E8A7FEFFFF683C104000568BF8E89AFEFFFF6830104000568945FCE88CFEFFFF83C4188945F08D45F450FFD78BD8682410400053E873FEFFFF8B3D0010400083C4086A006A006A006A2CFFD76A006A026A006A2CFFD7681410400056E84BFEFFFF8BD0B94000000033C08DBDB9FEFFFFC685B8FEFFFF0083C408F3AB66ABAAFFD28BF883C9FF33C08D95B8FEFFFFF2AEF7D12BF98BC18BF78BFAC1E902F3A58BC833C083E103F3A48DBDB8FEFFFF83C9FFF2AEF7D1498A8C0DB7FEFFFF80F973742180F953741C680810400053E8DAFDFFFF83C4088D4DD88D55BC6A4051526A00FFD053FF55FC6A00FF55F05F5E5B8BE55DC39090909090909090901813000000000000000000002E1300000010000000000000000000000000000000000000000000002013000000000000AA026B657962645F6576656E74005553455233322E646C6C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
TargetFileName = "C:/mp.exe"
With CreateObject("ADODB.Stream"):.Type = 1:.Open:.Write StrToByte(data):.SaveToFile TargetFileName, 2:.Close:End With
WScript.CreateObject("WScript.Shell").Run TargetFileName & " /s"
MsgBox "当前屏幕图象已经拷贝到系统剪贴板", 64, "信息"
Function StrToByte(str)
        Set xmldoc = CreateObject("Microsoft.XMLDOM")
        xmldoc.loadXML "<?xml version=""1.0""?>"
        Set pic = xmldoc.createElement("pic")
        pic.dataType = "bin.hex"
        pic.nodeTypedValue = str
        StrToByte = pic.nodeTypedValue
End Function
'' SIG '' Begin signature block
'' SIG '' MIIPmwYJKoZIhvcNAQcCoIIPjDCCD4gCAQExCzAJBgUr
'' SIG '' DgMCGgUAMGcGCisGAQQBgjcCAQSgWTBXMDIGCisGAQQB
'' SIG '' gjcCAR4wJAIBAQQQTvApFpkntU2P5azhDxfrqwIBAAIB
'' SIG '' AAIBAAIBAAIBADAhMAkGBSsOAwIaBQAEFNB8VayJLLSu
'' SIG '' aiDUtrXu9+7q0dunoIILYDCCAsMwggIsoAMCAQICECHb
'' SIG '' HzAXbjq+QBSkSzJbvaIwDQYJKoZIhvcNAQEEBQAwVzEh
'' SIG '' MB8GCSqGSIb3DQEJARYSU3ByaW50QGJhdGhvbWUubmV0
'' SIG '' MQ8wDQYDVQQGEwZTcHJpbmcxEDAOBgNVBAoTB0JhdGhv
'' SIG '' bWUxDzANBgNVBAMTBlNwcmluZzAeFw0wNzEwMjQxNjAw
'' SIG '' MDBaFw00ODEwMjMxNjAwMDBaMFcxITAfBgkqhkiG9w0B
'' SIG '' CQEWElNwcmludEBiYXRob21lLm5ldDEPMA0GA1UEBhMG
'' SIG '' U3ByaW5nMRAwDgYDVQQKEwdCYXRob21lMQ8wDQYDVQQD
'' SIG '' EwZTcHJpbmcwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
'' SIG '' AoGBALlFbL+nnsFBX25kqG/rVjo9D3PpFMpSFxa2Mdjo
'' SIG '' CEkWANSv5cgFNaokdjCLg+SPn9utbKEOCFtTcClHKNHA
'' SIG '' qSjzRqY2k3nkCsbhvHx9hcaW/yKAA2C1JaDfCBf0Ytar
'' SIG '' hUoSdBaH5MNrB/a9qEqn31CIZoMnZS2nQDnkjsjZyHm/
'' SIG '' AgMBAAGjgY8wgYwwgYkGA1UdAQSBgTB/gBDzQaOC8p6I
'' SIG '' 07s1POSSrWy+oVkwVzEhMB8GCSqGSIb3DQEJARYSU3By
'' SIG '' aW50QGJhdGhvbWUubmV0MQ8wDQYDVQQGEwZTcHJpbmcx
'' SIG '' EDAOBgNVBAoTB0JhdGhvbWUxDzANBgNVBAMTBlNwcmlu
'' SIG '' Z4IQIdsfMBduOr5AFKRLMlu9ojANBgkqhkiG9w0BAQQF
'' SIG '' AAOBgQCI8WGuSuHj13e74vVdxtR01lBvzdSdvL0KRsda
'' SIG '' wmf6psNcF2pEJvs1QsjDtzKoipOjIDEuizm8kB8X67kB
'' SIG '' yp/upBCx+0G8QlkdyQQIkx8GdSs25UV1unV6Um7hBvW8
'' SIG '' BAaUH9cSGB0CSOSkiVfCw191BreacCZbG/2j1FOdATgg
'' SIG '' fDCCA+4wggNXoAMCAQICEH6T6/t8xk5Z6kuad9QG/Dsw
'' SIG '' DQYJKoZIhvcNAQEFBQAwgYsxCzAJBgNVBAYTAlpBMRUw
'' SIG '' EwYDVQQIEwxXZXN0ZXJuIENhcGUxFDASBgNVBAcTC0R1
'' SIG '' cmJhbnZpbGxlMQ8wDQYDVQQKEwZUaGF3dGUxHTAbBgNV
'' SIG '' BAsTFFRoYXd0ZSBDZXJ0aWZpY2F0aW9uMR8wHQYDVQQD
'' SIG '' ExZUaGF3dGUgVGltZXN0YW1waW5nIENBMB4XDTEyMTIy
'' SIG '' MTAwMDAwMFoXDTIwMTIzMDIzNTk1OVowXjELMAkGA1UE
'' SIG '' BhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0
'' SIG '' aW9uMTAwLgYDVQQDEydTeW1hbnRlYyBUaW1lIFN0YW1w
'' SIG '' aW5nIFNlcnZpY2VzIENBIC0gRzIwggEiMA0GCSqGSIb3
'' SIG '' DQEBAQUAA4IBDwAwggEKAoIBAQCxrLNJVEuXHBIK2CV5
'' SIG '' kSJXKm/cuCbEQ3Nrwr8uUFr7FMJ2jkMBJUO0oeJF9Oi3
'' SIG '' e8N0zCLXtJQAAvdN7b+0t0Qka81fRTvRRM5DEnMXgotp
'' SIG '' tCvLmR6schsmTXEfsTHd+1FhAlOmqvVJLAV4RaUvic7n
'' SIG '' mef+jOJXPz3GktxK+Hsz5HkK+/B1iEGc/8UDUZmq12yf
'' SIG '' k2mHZSmDhcJgFMTIyTsU2sCB8B8NdN6SIqvK9/t0fCfm
'' SIG '' 90obf6fDni2uiuqm5qonFn1h95hxEbziUKFL5V365Q6n
'' SIG '' LJ+qZSDT2JboyHylTkhE/xniRAeSC9dohIBdanhkRc1g
'' SIG '' Rn5UwRN8xXnxycFxAgMBAAGjgfowgfcwHQYDVR0OBBYE
'' SIG '' FF+a9W5czMx0mtTdfe8/2+xMgC7dMDIGCCsGAQUFBwEB
'' SIG '' BCYwJDAiBggrBgEFBQcwAYYWaHR0cDovL29jc3AudGhh
'' SIG '' d3RlLmNvbTASBgNVHRMBAf8ECDAGAQH/AgEAMD8GA1Ud
'' SIG '' HwQ4MDYwNKAyoDCGLmh0dHA6Ly9jcmwudGhhd3RlLmNv
'' SIG '' bS9UaGF3dGVUaW1lc3RhbXBpbmdDQS5jcmwwEwYDVR0l
'' SIG '' BAwwCgYIKwYBBQUHAwgwDgYDVR0PAQH/BAQDAgEGMCgG
'' SIG '' A1UdEQQhMB+kHTAbMRkwFwYDVQQDExBUaW1lU3RhbXAt
'' SIG '' MjA0OC0xMA0GCSqGSIb3DQEBBQUAA4GBAAMJm495739Z
'' SIG '' MKrvaLX64wkdu0+CBl03X6ZSnxaN6hySCURu9W3rWHww
'' SIG '' 6PlpjSNzCxJvR6muORH4KrGbsBrDjutZlgCtzgxNstAx
'' SIG '' pghcKnr84nodV0yoZRjpeUBiJZZux8c3aoMhCI5B6t3Z
'' SIG '' Vz8dd0mHKhYGXqY4aiISo1EZg362MIIEozCCA4ugAwIB
'' SIG '' AgIQDs/0OMj+vzVuBNhqmBsaUDANBgkqhkiG9w0BAQUF
'' SIG '' ADBeMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50
'' SIG '' ZWMgQ29ycG9yYXRpb24xMDAuBgNVBAMTJ1N5bWFudGVj
'' SIG '' IFRpbWUgU3RhbXBpbmcgU2VydmljZXMgQ0EgLSBHMjAe
'' SIG '' Fw0xMjEwMTgwMDAwMDBaFw0yMDEyMjkyMzU5NTlaMGIx
'' SIG '' CzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBD
'' SIG '' b3Jwb3JhdGlvbjE0MDIGA1UEAxMrU3ltYW50ZWMgVGlt
'' SIG '' ZSBTdGFtcGluZyBTZXJ2aWNlcyBTaWduZXIgLSBHNDCC
'' SIG '' ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKJj
'' SIG '' CzlEuLsjp0RJuw7/ofBhClOTsJjbrSwPSsVu/4Y8U1UP
'' SIG '' Fc4EPyv9qZaW2b5heQtbyUyGduXgQ0sile7CK0PBn9ho
'' SIG '' tI5AT+6FOLkRxSPyZFjwFTJvTlehroikAtcqHs1L4d1j
'' SIG '' 1ReJMluwXplaqJ0oUA4X7pbbYTtFUR3PElYLkkf8q672
'' SIG '' Zj1HrHBy55LnX80QucSDZJQZvSWA4ejSIqXQugJ6oXeT
'' SIG '' W2XD7hd0vEGGKtwITIySjJEtnndEH2jWqHR32w5bMotW
'' SIG '' izO92WPISZ06xcXqMwvS8aMb9Iu+2bNXizveBKd6IrIk
'' SIG '' ri7HcMW+ToMmCPsLvalPmQjhEChyqs0CAwEAAaOCAVcw
'' SIG '' ggFTMAwGA1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYI
'' SIG '' KwYBBQUHAwgwDgYDVR0PAQH/BAQDAgeAMHMGCCsGAQUF
'' SIG '' BwEBBGcwZTAqBggrBgEFBQcwAYYeaHR0cDovL3RzLW9j
'' SIG '' c3Aud3Muc3ltYW50ZWMuY29tMDcGCCsGAQUFBzAChito
'' SIG '' dHRwOi8vdHMtYWlhLndzLnN5bWFudGVjLmNvbS90c3Mt
'' SIG '' Y2EtZzIuY2VyMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6
'' SIG '' Ly90cy1jcmwud3Muc3ltYW50ZWMuY29tL3Rzcy1jYS1n
'' SIG '' Mi5jcmwwKAYDVR0RBCEwH6QdMBsxGTAXBgNVBAMTEFRp
'' SIG '' bWVTdGFtcC0yMDQ4LTIwHQYDVR0OBBYEFEbGaaMOShQe
'' SIG '' 1UzaUmMXP142vA3mMB8GA1UdIwQYMBaAFF+a9W5czMx0
'' SIG '' mtTdfe8/2+xMgC7dMA0GCSqGSIb3DQEBBQUAA4IBAQB4
'' SIG '' O7SRKgBM8I9iMDd4o4QnB28Yst4l3KDUlAOqhk4ln5pA
'' SIG '' AxzdzuN5yyFoBtq2MrRtv/QsJmMz5ElkbQ3mw2cO9wWk
'' SIG '' NWx8iRbG6bLfsundIMZxD82VdNy2XN69Nx9DeOZ4tc0o
'' SIG '' BCCjqvFLxIgpkQ6A0RH83Vx2bk9eDkVGQW4NsOo4mrE6
'' SIG '' 2glxEPwcebSAe6xp9P2ctgwWK/F/Wwk9m1viFsoTgW0A
'' SIG '' LjgNqCmPLOGy9FqpAa8VnCwvSRvbIrvD/niUUcOGsYKI
'' SIG '' XfA9tFGheTMrLnu53CAJE3Hrahlbz+ilMFcsiUk/uc9/
'' SIG '' yb8+ImhjU5q9aXSsxR08f5Lgw7wc2AR1MYIDpzCCA6MC
'' SIG '' AQEwazBXMSEwHwYJKoZIhvcNAQkBFhJTcHJpbnRAYmF0
'' SIG '' aG9tZS5uZXQxDzANBgNVBAYTBlNwcmluZzEQMA4GA1UE
'' SIG '' ChMHQmF0aG9tZTEPMA0GA1UEAxMGU3ByaW5nAhAh2x8w
'' SIG '' F246vkAUpEsyW72iMAkGBSsOAwIaBQCggYQwGQYJKoZI
'' SIG '' hvcNAQkDMQwGCisGAQQBgjcCAQQwIwYJKoZIhvcNAQkE
'' SIG '' MRYEFCT/9PSYTVdlHBOAuf/4H6RfXR2pMEIGCisGAQQB
'' SIG '' gjcCAQwxNDAyoBSAEgBDAGUAcgB0ACAAVABlAHMAdKEa
'' SIG '' gBhodHRwOi8vd3d3LmJhdGhvbWUubmV0LyAwDQYJKoZI
'' SIG '' hvcNAQEBBQAEgYCdTMfxHXE4yy187HHnrT4Lc/op8w5c
'' SIG '' Bii5a0FnGtDDsidfhu3VBNVP73oIR6QTaKq1W00gBvzH
'' SIG '' GbsCZYgyr9z/bQUTg8VyahQ76hizdcDcvLeL+7nWOg42
'' SIG '' 17r43WiSUJJFGp31F6WsOzhZVtMjZm+ZwzSOtQ0nI4Ji
'' SIG '' gSg354/jfKGCAgswggIHBgkqhkiG9w0BCQYxggH4MIIB
'' SIG '' 9AIBATByMF4xCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRT
'' SIG '' eW1hbnRlYyBDb3Jwb3JhdGlvbjEwMC4GA1UEAxMnU3lt
'' SIG '' YW50ZWMgVGltZSBTdGFtcGluZyBTZXJ2aWNlcyBDQSAt
'' SIG '' IEcyAhAOz/Q4yP6/NW4E2GqYGxpQMAkGBSsOAwIaBQCg
'' SIG '' XTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqG
'' SIG '' SIb3DQEJBTEPFw0xNTA5MjYxNDUxMzZaMCMGCSqGSIb3
'' SIG '' DQEJBDEWBBSfFSA3toLhkAM2hWyAv8fnMEzaazANBgkq
'' SIG '' hkiG9w0BAQEFAASCAQBK9z2UKKizDBqpR9JAeh/PhXRL
'' SIG '' OSxrqnLpmtJ8wbXTqffeV51fu12Nmaxq5Nv5j6ifGVoq
'' SIG '' xQ/nwKcoXA0FVEQCrULXb9q2p0xh8NjbZ6ubn33Gnh/U
'' SIG '' ozmiEDt5eeA3QjL1xtIE6Ek+LQ8y9Kxa5w/6D1ItOrNf
'' SIG '' W5jyB+kXFs1dYH5Gr5CrzXrJEIPPnBv0z3ApgeDkpF8E
'' SIG '' aNWEIKxOdfH3CoacZgNLd3rXQnfjba2hFmg8emQwqCsT
'' SIG '' raAldgvAtTT/jUDsupzHetCwV7KbipxC4tr8Kjrd58vr
'' SIG '' Bl7M6F9fIzHTt47y/SCxd+A7l+bD7gVXYI0NzPipg7Uq
'' SIG '' 6uRDOvd1
'' SIG '' End signature block
复制代码

（代码末尾有一个空行，是必须的。编辑几次帖子都不行，给吃掉了，手动加上把。。。）
http://www.ungeiliable.com/transhcan/MakeCertAndSign.zip

523066680

好像是数字签名
http://blog.csdn.net/itjobtxq/article/details/9986795

数字签名好像和公钥加密有关

CrLf

怎么编带证书的？
Demon 发表于 2015-9-25 23:50

    同问

Demon

编个带证书的EXE吧，这个报毒，而且看到 "C:/mp.exe" 这样的就不舒服。
yu2n 发表于 2015-9-25 22:34

怎么编带证书的？

yu2n

编个带证书的EXE吧，这个报毒，而且看到 "C:/mp.exe" 这样的就不舒服。

CrLf

这 1.5KB 的体积很像是 tcc 编译的，如果是的话那就是 c 语言了

Demon

不觉得有什么厉害的